How should you approach a company about potential security issues?

You may think a company is exposed to a problem and want to help. How you approach them determines whether they become a client, shut the door, or even create a legal problem.

A better approach: companies in their industry are facing certain issues—would they like help checking whether those issues affect them too?

Give them a reason to talk. Ask for permission. Explain what you can examine and what you're qualified to do.

Showing up and saying “I've found all your flaws” is a terrible way to start a relationship.

No testing before contact

Don’t test any of the company’s systems before getting written permission. Not even a small test or one to use as an example. Without permission, it may be treated as an intrusion.

Also, don’t publicly expose anyone’s flaw, whether on social media, in a group, or as an example in a talk. That damages the relationship and may harm the company and its customers.

Start the conversation with the industry

Talk about problems companies in the same industry are facing, based on public information: common scams, reported data breaches, and risks from tools the industry often uses.

Then ask whether they’d like help checking whether any of this affects them. That gives the conversation a reason, avoids accusing anyone, and leaves the decision to the company.

Be clear about what you do

Explain what you can examine and what you’re qualified to do. For example, you can review account settings and permissions but not conduct a full penetration test. If the work goes beyond your limits, say that you can refer a specialist.

Once they agree, put the scope, dates, company contact, and what to do if anything unexpected happens in writing.

If the company already has a channel

Some companies have a vulnerability disclosure program with rules for people who find flaws. If one exists, follow its rules. If not, keep the conversation respectful and get formal permission.

1. Research public, known risks in the company’s industry.
2. Prepare a short message about the industry, not the company’s flaws.
3. Explain what you can examine and what is outside your expertise.
4. Ask permission and wait for a response without testing anything first.
5. Put the scope, dates, and contact in writing before starting.
6. Deliver the results privately to the company.

• Testing the system before getting permission to have proof, which may be a crime and destroys trust.
• Opening by saying you found all their flaws, which puts the company on the defensive.
• Publicly exposing a flaw to apply pressure, which harms customers and your reputation.
• Promising more than you know how to do, which creates problems in the middle of the work.

• Talk about the industry, not their flaws.
• Ask permission before looking.
• Be clear about what you can do.

• CourseFormação Vendas com IA 4 — from zero to the first clientAn authorized audit as a first step into the field.
• CourseProfissional 2030 · Auditor de IAHow to define the scope and deliver a report the client can understand.
• Projectblinda-siteA diagnosis to offer after authorization: analyzes the website without changing anything.

Some of these materials are in Portuguese.